practical, step-by-step guide to building a self-hosted email server with SMTP, IMAP, webmail, TLS encryption and mailbox authentication.

Running your own mail server gives you greater control over your email infrastructure, user accounts and data. With Ubuntu Server 26.04, Postfix, Dovecot 2.4 and Roundcube, you can build a complete email platform capable of sending, receiving, storing and managing email through a web browser or desktop email client.

This guide walks through the installation and configuration process, from preparing your server and DNS records to configuring Postfix for mail delivery, Dovecot for IMAP access and Roundcube for webmail.

The configuration uses a single-domain deployment with virtual mailboxes, encrypted connections and MariaDB-backed webmail infrastructure where appropriate. It is intended as a foundation that can later be extended with DKIM signing, spam filtering, antivirus scanning and additional domains.

Important: Ubuntu Server 26.04 and Dovecot 2.4 introduce version-specific considerations. Dovecot 2.4 changes parts of its configuration syntax compared with Dovecot 2.3, so older tutorials should not be copied verbatim. Verify package versions and configuration directives against the documentation for the versions actually installed.

1. Understand the mail server architecture

Before installing the software, it is useful to understand how the components work together.

• Postfix: Receives incoming email through SMTP and sends outgoing messages to other mail servers.
• Dovecot 2.4: Provides IMAP access to stored messages and can authenticate users for Postfix SMTP submission.
• Roundcube: Provides a browser-based interface for reading, composing and managing email.
• Nginx: Serves the Roundcube web application over HTTPS.
• PHP-FPM: Executes the PHP code used by Roundcube.
• MariaDB: Stores Roundcube application settings and user preferences. It can also support virtual mailbox account management if you choose a database-backed mail architecture.
• Let's Encrypt: Provides publicly trusted TLS certificates for supported services.

A typical message flow looks like this:

An external mail server connects to Postfix on port 25.

1. Postfix accepts the message and delivers it to the recipient's mailbox.
2. Dovecot makes that mailbox available over IMAP.
3. Roundcube connects to Dovecot to display messages and to Postfix to submit outgoing email.
4. Remote mail servers receive outgoing messages from Postfix.

2. Plan your domain and server

For this example, the following placeholder values will be used throughout the guide. Replace them with your own domain and server details before running the commands.

Setting	Example value
Mail domain	example.com
Mail hostname	mail.example.com
Webmail address	webmail.example.com
Server public IP	203.0.113.10
Mail storage	/var/vmail
Virtual mail user	vmail
Mailbox format	Maildir

The IP address shown above belongs to a documentation-only address range. Substitute your actual public IP address.

Before proceeding, ensure that you have:

• A registered domain name.
• A server with Ubuntu Server 26.04 installed.
• A static public IP address, preferably with a clean sending reputation.
• Access to your domain's DNS management.
• Inbound and outbound network access for the required mail ports.
• A reverse DNS (PTR) record that matches your mail server hostname, where your provider supports it.

Residential internet connections may block outbound port 25, and many providers do not allow customers to configure reverse DNS. If either restriction applies, you may need a VPS or an external SMTP relay.

3. Configure DNS records

Correct DNS configuration is essential for reliable email delivery. Incorrect records can prevent your server from receiving mail or cause messages to be rejected by other providers.

Create the following records with your DNS provider.

Type	Name	Value
A	mail	Your server's public IPv4 address
A	webmail	Your web server's public IPv4 address
MX	@	mail.example.com with priority 10
TXT	@	SPF policy for authorised senders
TXT	_dmarc	A DMARC policy
PTR	Your public IP	mail.example.com

For a simple single-server deployment, an initial SPF record might be:

v=spf1 mx -all

This authorises the hosts listed in your domain's MX records to send email for the domain. If you use an external relay or other sending services, update the policy accordingly.

A cautious initial DMARC policy could be:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Create the dmarc@example.com reporting address or another valid reporting destination before relying on aggregate reports.

Start with monitoring and move to a stricter policy after checking legitimate mail sources. DKIM is not configured yet; add DKIM signing and publish the corresponding DNS record before treating the server as production-ready.

Verify DNS resolution:

dig +short A mail.example.com
dig +short MX example.com
dig +short TXT example.com
dig +short TXT _dmarc.example.com
dig -x YOUR_PUBLIC_IP

The MX record should point to the mail hostname, not directly to the IP address.

4. Update Ubuntu Server and set the hostname

Start by installing available system updates.

sudo apt update
sudo apt full-upgrade -y
sudo hostnamectl set-hostname mail.example.com

Check the hostname:

hostnamectl
hostname -f

Ensure that the hostname resolves correctly. If necessary, update /etc/hosts so the machine's local hostname resolves consistently. Do not substitute a public IP address in the example without checking your actual network configuration.

Reboot if the system upgrade requires it:

sudo reboot

After reconnecting, confirm the operating system and kernel:

cat /etc/os-release
uname -r

5. Install Postfix

Postfix is responsible for SMTP transport, receiving incoming messages and delivering outbound mail.

Install the package:

sudo apt install postfix

During the package configuration prompts, select Internet Site if this server will send and receive mail directly.

Enter your mail domain when prompted for the system mail name, or use the fully qualified hostname where appropriate to your deployment.

Check that Postfix is running:

sudo systemctl enable --now postfix
sudo systemctl status postfix

Display the active configuration:

sudo postconf -n

Set the basic identity and trusted-network parameters:

sudo postconf -e 'myhostname = mail.example.com'
sudo postconf -e 'mydomain = example.com'
sudo postconf -e 'myorigin = $mydomain'
sudo postconf -e 'inet_interfaces = all'
sudo postconf -e 'inet_protocols = all'
sudo postconf -e 'mydestination = $myhostname, localhost.$mydomain, localhost'

These settings establish the server identity and limit the local delivery domains. The mydestination setting is important: if you later implement virtual mailboxes for example.com, do not inadvertently configure that same domain for conflicting local UNIX mailbox delivery.

Do not add every network to mynetworks. Only explicitly trusted hosts should be allowed to relay mail without normal recipient and authentication checks.

At this stage, Postfix is installed, but a production mail server still requires a deliberate mailbox design, secure submission configuration, TLS and anti-relay testing.

6. Choose a mailbox storage design

There are two common approaches to storing email.

System-user mailboxes use Linux accounts and local delivery. They can be convenient for small installations, but managing many email accounts becomes cumbersome.

Virtual mailboxes use email addresses independent of Linux login accounts. They are better suited to hosting one or more domains and can be managed using database-backed account records.

This guide uses the virtual-mailbox approach for its storage layout:

/var/vmail/
└── example.com/
    └── user/
        ├── cur/
        ├── new/
        └── tmp/

These directories form a Maildir mailbox. Each email user can access their own mailbox through Dovecot without needing a shell account.

Create a dedicated system user:

sudo groupadd --system vmail
sudo useradd --system \
  --gid vmail \
  --home-dir /var/vmail \
  --shell /usr/sbin/nologin \
  vmail

Create the mailbox directory:

sudo mkdir -p /var/vmail/example.com
sudo chown -R vmail:vmail /var/vmail
sudo chmod 750 /var/vmail

The ownership and permissions must match the final Postfix and Dovecot configuration. Do not make the mail directory world-writable.

7. Install Dovecot 2.4

Dovecot provides IMAP access to the stored messages and can also perform SMTP authentication for Postfix.

Install the required Dovecot components using Ubuntu's package manager:

sudo apt install dovecot-core dovecot-imapd

Check which version is installed:

dovecot --version
apt-cache policy dovecot-core dovecot-imapd

Version check: This guide targets Dovecot 2.4. If the Ubuntu repositories provide a different major or minor version, do not assume these commands installed Dovecot 2.4. Verify package availability and use a supported repository or package source if required. Avoid mixing packages from incompatible Ubuntu releases.

Dovecot 2.4 has configuration changes compared with 2.3, so follow the official documentation for the exact release.

Before changing the configuration, back up the existing files:

sudo cp -a /etc/dovecot /etc/dovecot.backup

Review the installed configuration:

sudo doveconf -n

The main configuration is normally under /etc/dovecot/, with additional settings commonly located in conf.d/.

The key settings you will need to configure include:

• IMAP service availability.
• Maildir mailbox location.
• Mailbox ownership and permissions.
• User authentication.
• TLS certificates and encryption requirements.
• The authentication socket used by Postfix, if SMTP authentication is delegated to Dovecot.

Do not paste an entire Dovecot 2.3 configuration into Dovecot 2.4. In particular, review the release-specific syntax for mail location, authentication mechanisms, passdb/userdb configuration, service listeners and TLS settings before enabling the service.

8. Configure TLS certificates

Publicly trusted TLS certificates protect connections between email clients, webmail and your server.

For a server using Nginx, install Certbot and its Nginx integration:

sudo apt install certbot python3-certbot-nginx

Configure Nginx for the webmail hostname first, then request a certificate:

sudo certbot --nginx -d webmail.example.com

If you also serve HTTPS on mail.example.com, request a certificate containing that name too:

sudo certbot --nginx \
  -d mail.example.com \
  -d webmail.example.com

Use only hostnames that resolve to your server and are configured for the appropriate validation method.

The certificate and private key will typically be available under:

/etc/letsencrypt/live/mail.example.com/

Configure Postfix and Dovecot to use the certificate and private key through the directives supported by their installed versions. Protect the private key and ensure that the services can read it securely.

For mail clients, the usual secure connection options are:

• SMTP submission on port 587 with STARTTLS and authentication.
• IMAPS on port 993 with TLS.
• SMTP port 25 for server-to-server delivery, normally supporting STARTTLS.

Do not expose an authenticated submission service without encryption and appropriate authentication controls.